Most recent entries from all

bdu:2025-15219

certfr-2025-avi-0941 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2025-avi-0941

EUVD-2026-256564

fkie_cve-2025-62518

astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.

GHSA-j5gw-2vrg-8fgx — astral-tokio-tar Vulnerable to PAX Header Desynchronization

Affected: crates.io: astral-tokio-tar, crates.io: tokio-tar

## Summary

Versions of `astral-tokio-tar` prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers.

This vulnerability was disclosed to multiple Rust tar parsers, all derived from the original `async-tar` fork of `tar-rs`.

## Details

### Vulnerability Description

The vulnerability stems from inconsistent handling of PAX extended headers versus ustar headers when determining file data boundaries. Specifically:

1. **PAX header** correctly specifies the file size (e.g., `size=1048576`) 2. **ustar header** incorrectly specifies zero size (`size=000000000000`) 3. **tokio-tar** advances the stream position based on the ustar size (0 bytes) 4. **Inner content** is then interpreted as legitimate outer archive entries

### Attack Mechanism

When a TAR file contains:

- An outer entry with PAX `size=N` but ustar `size=0` - File data that begins with valid TAR header structures - The parser treats inner content as additional outer entries

This creates a **header/data desynchronization** where the parser's position becomes misaligned with actual file boundaries.

### Root Cause

```rust // Vulnerable: Uses ust…

msrc_CVE-2025-62518 — astral-tokio-tar Vulnerable to PAX Header Desynchronization

msrc_CVE-2025-62518

openSUSE-SU-2025:15658-1 — python311-uv-0.9.5-1.1 on GA media

python311-uv-0.9.5-1.1 on GA media

RUSTSEC-2025-0110 — astral-tokio-tar Vulnerable to PAX Header Desynchronization

Affected: crates.io: astral-tokio-tar

Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers.

This vulnerability was disclosed to multiple Rust tar parsers, all derived from the original async-tar fork of tar-rs.

For additional information see [Edera's blog post](https://edera.dev/stories/tarmageddon).

SUSE-SU-2026:20077-1 — Security update for python-uv

Security update for python-uv

UBUNTU-CVE-2025-62518

Affected: Ubuntu:25.10: rust-astral-tokio-tar, Ubuntu:26.04:LTS: rust-astral-tokio-tar